put cookie protection in place